halo-2.25.4-CVE-2026-67919

Authenticated Remote Code Execution RCE via Unvalidated Plugin URI Installation in Halo 2.25.4 1. Vulnerability Summary A critical security vulnerability has been identified in Halo version 2.25.4. The application provides an administrative endpoint to install or upgrade plugins from a remote URI...

LogoFail-PoC

🇮🇱 BringThemHome NeverAgainIsNow 🇮🇱 We demand the safe return of all citizens who have been taken hostage by the terrorist group Hamas. We will not rest until every hostage is released and returns home safely. You can help bring them back home.https://stories.bringthemhomenow.net/ BIOS Image Parser...

CVE-2025-56762

Description: The application leverages “error.php” to serve the respective error code as per the use case back to the web application upon encountering an error. Upon inspecting the source code, it was found that the application does not sanitize the parameter “code” when crafting a malicious...

Foxit-Reader-RCE-with-virualalloc-and-shellcode-for-CVE-2018-9948-and-CVE-2018-9958

Custom Exploit : Foxit Reader version 9.0.1.1049 Use After Free with ASLR and DEP bypass on heap My Custom Exploit : Foxit-Reader-RCE-with-virualalloc-and-shellcode-for-CVE-2018-9948-and-CVE-2018-9958 Custom exploit for Win 7 Has space for shellcode My custom ROP chain makes space for shellcode i...

CVE-2023-41425-RCE-WonderCMS-4.3.2

🚨 WonderCMS RCE Exploit Tool CVE-2023-41425 This Python-based offensive security tool automates the exploitation of a Remote Code Execution RCE vulnerability in WonderCMS 4.3.2 , specifically CVE-2023-41425. It streamlines the process of crafting a malicious ZIP theme module and delivering a...

EXPLOIT-CVE-2026-8832-

EXPLOIT-CVE-2026-8832 An exploitation tool to test for Remote Code Execution RCE vulnerabilities in the WordPress plugin WPCode Lite Insert Headers and Footers v2.3.5. This vulnerability stems from registering the Custom Post Type CPT wpcode without defining a custom capabilitytype. This oversigh...

CVE-2025-47917

CVE-2025-47917 Exploit Use-After-Free in mbedTLS Author : Byte Reaper Telegram : @ByteReaper0 CVE : CVE-2025-47917 Vulnerability : Use-After-Free UAF in mbedTLS 3.6.4 name parsing Description This repository contains an exploit targeting a Use-After-Free vulnerability in the...

CVE-2023-30253-PoC

CVE-2023-30253 CVE-2023-30253 PoC Description This is my PoC for the CVE-2023-30253 Dolibarr 17.0.0 PHP Code Injection, when the CMS Website plugin core is enabled, an authenticated attacker can obtain remote command execution via php code injection bypassing the application restrictions...

CVE-2022-1388

CVE-2022-1388 CVE-2022-1388 F5 BIG-IP iControl REST Auth Bypass RCE. POST /mgmt/tm/util/bash HTTP/1.1 Host: Accept-Encoding: gzip, deflate Accept: / Connection: close, X-F5-Auth-Token, X-Forwarded-For, Local-Ip-From-Httpd, X-F5-New-Authtok-Reqd, X-Forwarded-Server, X-Forwarded-Host Content-type:...

CVE-2024-20931

CVE-2024-20931 CVE-2024-20931, this is the bypass of the patch of CVE-2023-21839 Oracle Weblogic Usage: Setup JNDI, the specific one from https://github.com/WhiteHSBG/JNDIExploit/ Exploit: java -jar CVE-2024-20931.jar Please input target IP:127.0.0.1 Please input target port:7001 Please input RMI...

CVE-2020-8813

CVE-2020-8813 Cacti v1.2.8 Unauthenticated Remote Code Execution Uses Python 3 Running without Docker: git clone https://github.com/hexcowboy/CVE-2020-8813.git && cd CVE-2020-8813 python3 -m venv env && source env/bin/activate pip install -r requirements.txt python exploit.py Running with Docker:...

Exploit-CVE-2023-38646-Metabase

Exploit CVE-2023-38646 Metabase before 0.46.6.1 open source and before 1.46.6.1 Enterprise Exploit for the Remote Code Execution RCE vulnerability identified in Metabase versions before 0.46.6.1 open source and 1.46.6.1 Enterprise. The vulnerability allows attackers to execute arbitrary commands ...

CVE-2023-28432-minio_update_rce

minio-CVE-2023-28432-rce https://github.com/AbelChe/evilminio/tree/main Original project repository Personal packaging archive Affected versions: 2019-12-17T23-16-33Z to RELEASE.2023-03-20T20-16-18Z Reproduction: https://www.yuque.com/jason-soozc/luhd40/pgabr9xvg0kgx85v?singleDoc "MinIO...

CVE-2024-28515

CVE-2024-28515 Description Buffer Overflow vulnerability in CSAPPLab CSAPP Lab3 15-213 Fall 20xx allows a remote attacker to execute arbitrary code via the lab3 of csapp,lab3/buflab-update.pl component. Additional Information CNVD has completed verification of this vulnerability, but it has not...

CVE-2026-4447

CVE-2026-4447 - V8 in Google Chrome prior to Remote Code Execution Quick Usage python3 exploit.py -t "C:\Path\To\Target" -o demo.zip --data-file payload.exe Exploitation Notes Severity: HIGH CVSS: 8.8 Impact: Confidentiality, Integrity, Availability Published: 2026-03-20 Technical Summary...

CVE-2019-9978

Social Warfare Plugin Wordpress 3.5.2 Remote Code Execution Wordpress Social Warfare Remote Code Execution AUTO UPLOAD SHELL Date: March, 2019 Download Link: https://wordpress.org/plugins/social-warfare/ Reference: https://wpvulndb.com/vulnerabilities/9259 Version: CVE: 2019-9978 USAGE: python...

react2shell-poc

React2Shell - CVE-2025-55182 PoC Proof of Concept for CVE-2025-55182 , a critical unauthenticated Remote Code Execution vulnerability in React Server Components. CVSS Score: 10.0 Critical Vulnerability The vulnerability exists in React's Flight protocol deserializer. By exploiting prototype...

CVE-2018-7602

CVE-2018-7602 A remote code execution vulnerability exists within multiple subsystems of Drupal 7.x and 8.x. This potentially allows attackers to exploit multiple attack vectors on a Drupal site, which could result in the site being compromised. This vulnerability is related to Drupal core - High...

CVE-2025-54897-LAB

Lab: CVE-2025-54897 - Deserialization Vulnerability in Microsoft Office SharePoint 🚀 Overview This lab demonstrates a deserialization vulnerability in Microsoft Office SharePoint that enables remote code execution RCE. The issue arises from improper handling of untrusted serialized data within...

CVE-2020-7931

CVE-2020-7931: SSTI exploitation in Artifactory Pro CVE-2020-7931 is somewhat of a purposeful misconfiguration vulnerability in Artifactory that lets attackers conduct server-side template injections from a FreeMarker template. The vulnerability was discovered by Ryan Hanson from Atredis and was...